CVE-2026-44308
Last modified
CVE-2026-44308 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) did not verify the signature of incoming SNS messages. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) did not verify the signature of incoming SNS messages. An unauthenticated attacker who knows the endpoint URL could send crafted HTTP POST requests mimicking SNS Notification or SubscriptionConfirmation messages. This vulnerability is fixed in 4.0.2.
Metrics
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-44308?
How severe is CVE-2026-44308?
How do I fix CVE-2026-44308?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-44301Hugo is a static site generator. From 0.43 to before 0.161.0…8.1
- CVE-2026-44302Snappier is a high performance C# implementation of the Snap…7.5
- CVE-2026-44304Lemur manages TLS certificate creation. Prior to 1.9.0, Lemu…8.1
- CVE-2026-44305Lemur manages TLS certificate creation. Prior to 1.9.0, when…6.8
- CVE-2026-44306Statamic is a Laravel and Git powered content management sys…5.3
- CVE-2026-44307Mako is a template library written in Python. Prior to 1.3.1…8.7
- CVE-2026-44309Gitsign is a keyless Sigstore to signing tool for Git commit…5.3
- CVE-2026-4431The Easy Post Submission plugin for WordPress is vulnerable …9.1
- CVE-2026-44310Gitsign is a keyless Sigstore to signing tool for Git commit…5.4
- CVE-2026-44311Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4…6.1
- CVE-2026-44312css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, …5.8
- CVE-2026-44313Linkwarden is a self-hosted, open-source collaborative bookm…9.1
Are you affected by CVE-2026-44308?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST